Re: On classifying attacks

From: Godwin Stewart (gstewart_at_spamcop.net)
Date: 07/17/05

  • Next message: Amit Klein (AKsecurity): "NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein" 
    Date: Sun, 17 Jul 2005 11:41:54 +0200
To: Derek Martin <code@pizzashack.org>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Sat, 16 Jul 2005 12:40:29 -0400, Derek Martin <code@pizzashack.org> wrote:

    > It seems to me your statement can't be correct, because this is ALWAYS
    > the case. A local exploit requires that a local user run an
    > executable. A remote exploit requires that a local user run an
    > executable, even if that is accomplished merely by booting the system.
    > All exploits require running code, and code doesn't magically start
    > itself... Running code is required, because it is the very running
    > code which is being exploited.

    Maybe so, however with the case of the BIND attack, the vulnerability in
    locally running code (named) is being exploited by a remote attacker via the
    network.

    In the case of an e-mail containing malicious code, the code being exploited
    (parts of the Windows kernel or whatever) is being attacked by code running
    locally - on the *same* machine. In this sense it can hardly qualify as a
    "remote" exploit.

    - --
    G. Stewart - gstewart@spamcop.net

    A lot of money is tainted. 'Taint yours and 'taint mine.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.1 (GNU/Linux)

    iD8DBQFC2ifiK5oiGLo9AcYRAswqAJ9lPxLOVO45WpnKxWEYva41HSbnrwCfdkGT
    fEc+qbBBB4LKkzeR5bKMikg=
    =yzAH
    -----END PGP SIGNATURE-----

  • Next message: Amit Klein (AKsecurity): "NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein"

    Relevant Pages

    • Re: On classifying attacks
      ... > unless a local user runs an executable. ... But it is a remote *attack*. ... these definitions follow common usage. ...
      (Bugtraq)
    • Re: On classifying attacks
      ... >> unless a local user runs an executable. ... from a security point of view and has no associated vulnerability. ... This attack is pretty much independent on the client we use. ... >> This should be classified as a remote vulnerability. ...
      (Bugtraq)
    • Re: On classifying attacks
      ... A remote exploit requires that a local user run an ... double-clicked does not have a vulnerability. ... This is no different than if I handed you a disk, ... Would you call this a remote ...
      (Bugtraq)
    • Re: On classifying attacks
      ... >> But is this a remote exploit? ... > unless a local user runs an executable. ... > This should be classified as a remote vulnerability. ... local users make a decision to trust something (data in this case, ...
      (Bugtraq)
    • RE: Rooting out false positives
      ... mySQL is related to local user accounts on the machine, but also to remote ... Although this is a vulnerability to the accounts on the ... Rather than rooting out false positives, it is a question of understanding ...
      (Pen-Test)